Smishing

Text messages feel more personal and urgent than email, and phones make it harder to inspect links. Common Canadian lures include fake Canada Post or courier delivery fees, CRA refund notices, Interac e-Transfer alerts, highway toll payment requests and bank fraud warnings.

For businesses, smishing matters because staff use phones for MFA and work apps. A text claiming to be from IT, asking the employee to re-verify their Microsoft account, can lead to a credential phishing page that the company's email filters never see. Executives are also targeted with texts that appear to come from the CEO asking for a quick favour, often gift cards.

Defences are mostly behavioural and device-based. Tell staff that IT will never ask them to sign in through a text link, and give them an easy way to report suspicious texts. Use mobile device management and mobile threat protection where risk justifies it. Phishing-resistant MFA reduces the impact if someone does enter their credentials on a phone.

The Canadian Anti-Fraud Centre collects reports of smishing campaigns.